Skip to main content
HT_JDC
HT_JDC
New Member
October 8, 2025
Solved

Site-to-Site SD-WAN for slow network

  • October 8, 2025
  • 3 replies
  • 1012 views

Hello Experts,

 

I have an issue about site-to-site SD-WAN. Here is the situation.
There are 2 ipsec tunnels between 2 Fortigates.

One tunnel (called as X) is a simple ipsec tunnel.
The other (called as Y) is a ipsec aggregation tunnel which has 3 ipsec tunnels (Y1, Y2, Y3)

FG1 -- X ------- Network_A ------- X -- FG2
    -- Y - Y1 -- Network_B -- Y1 - Y --
         - Y2 -- Network_C -- Y2 -
         = Y3 -- Network_D -- Y3 -
(I hope you understand the above configuration.)

 

When all Network_A,B,C,D belong to normal network, everything is ok.
(Both X and Y are seen as green in SD-WAN performance SLA).

 

However, when Network_B,C,D belongs to slow network such as satellite,
Only X is OK (alive). Y is not alive as SD-WAN, although all ipsec tunnels (Y1, Y2, Y3)
and aggregated Y are established as vpn tunnel.
(Y is seen as red  in SD-WAN performance SLA, however all are seen as green in VPN page.)

 

In this case of slow network, ping response time is about 600ms.
At normal network here, the response time is less than 150ms.

 

What and how should I do so that both X and Y are active at slow network?

 

Thanks in advance,

Best answer by Atul_S

Hi,

 

You can make a few adjustments to make this work. First, you can consider increasing the probe timeout setting in the sla configuration to accommodate the higher latency for the slow network. Second, adjust the SLA thresholds for latency, jitter, and packet loss for the slow tunnel connections. Once you make these changes, monitor the SD-WAN perf status to verify if the agg tunnel becomes active.

 

Thanks,

3 replies

pukalmu3
pukalmu3
New Member
October 8, 2025

The symptoms sound like MTU changes across the WAN not being handled correctly. Try clamping MSS on an edge device that you control at one of the problematic sites. If that fixes the issue, you now know what to start troubleshooting.

HT_JDC
HT_JDCAuthor
New Member
October 8, 2025

Dear pukalmu3,

 

Thanks for your comments. MTUs in all cases are 1500.

Only difference would be latency (delay) between normal case and slow case, I think.

I am now looking for some related parameters.

 

Still waiting experts comments.

 

Thanks in advance.

 

Atul_S
Staff & Editor
Atul_SAnswer
Staff & Editor
October 9, 2025

Hi,

 

You can make a few adjustments to make this work. First, you can consider increasing the probe timeout setting in the sla configuration to accommodate the higher latency for the slow network. Second, adjust the SLA thresholds for latency, jitter, and packet loss for the slow tunnel connections. Once you make these changes, monitor the SD-WAN perf status to verify if the agg tunnel becomes active.

 

Thanks,

    HT_JDC
    HT_JDCAuthor
    New Member
    October 9, 2025

    Dear Atul,

     

    Thanks for your key comments.

    I will try. After I get something, I will get back here.

     

    Best regards,

     

    Atul_S
    Staff & Editor
    Atul_S
    Staff & Editor
    October 9, 2025

    Hi HT_JDC, 

     

    Sure, no problem.

     

    Thanks,

    fred
    fred
    New Member
    October 10, 2025

    Hi,

     

    It would help if you let us know what FG device you are working on, as well as pasting in your configuration, even with a show full:

     

    config system sdwan

    show full

     

    If you have worked just a bit with sdwan and fortinet over vsat, you should have already found out (or will soon find out :) that probe timeout by default is set to 500ms.. chosen by Fortinet.. and as a hidden default parameter.. so that is a bit below VSAT latency, and VSAT will "never come up" due to this silly value.. it may cause issues if you do not correct it. Hope that helps.

     

    PS: any success with ipsec aggregation?

    Terms & ConditionsAccessibility statement